Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-43869 · ADVISORY
• apache/thrift commit 0919c3d · WEB
• apache/thrift · PACKAGE
• apache/thrift release v0.23.0 · WEB
• lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r · WEB
• openwall.com/lists/oss-security/2026/05/05/3 · WEB
• access.redhat.com/errata/RHSA-2026:21769
• access.redhat.com/errata/RHSA-2026:22347
• access.redhat.com/errata/RHSA-2026:22423
• access.redhat.com/errata/RHSA-2026:23345
• access.redhat.com/errata/RHSA-2026:24503
• access.redhat.com/errata/RHSA-2026:24539
• access.redhat.com/errata/RHSA-2026:25273

Weitere Schwachstellen in org.apache.thrift:libthrift

• CVE-2026-43871HOCH 7.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects A…
• CVE-2020-13949HOCH 7.5In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potential…
• CVE-2019-0205HOCH 7.5In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data…
• CVE-2018-1320HOCH 7.5Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.t…
• CVE-2018-11798MITTEL 6.5The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in whi…